Critical Triofox bug exploited to run malicious payloads via AV configuration

According to Google Threat Intelligence Group (GTIG), hackers exploited Triofox flaw CVE-2025-12480 to bypass authentication and install remote access tools via the platform’s antivirus feature, with Mandiant tracking the threat cluster UNC6485 as behind the activity. The flaw, which has a CVSS score of 9.1, was exploited as early as 24 August 2025 to gain unauthenticated access and chain it with antivirus abuse to achieve code execution.

Mandiant found suspicious HTTP requests and noted that Triofox pages redirected to Access Denied unless the Host header was set to localhost, allowing creation of a new admin account during setup—the so‑called Cluster Admin account—for further malicious activity. The attack sequence included uploading a malicious batch via the antivirus path, a PowerShell downloader fetching a disguised payload from 84.200.80[.]252, and the payload installing Zoho UEMS to enable Zoho Assist and AnyDesk for remote access.

The advisory urges upgrading to the latest Triofox release (16.7.10368.56560), auditing admin accounts, and monitoring for anomalous outbound SSH traffic.